Financial gain and extortion

Financial gain is a common motive for attacking a computer system. The attacker wants to make money, either by selling something they have stolen or by getting an organisation to pay them. Financial gain is the motive; stealing data or breaking into systems is how the attacker goes about it.

Extortion means gaining money by force, threats or pressure. In a cyber attack, the attacker demands a ransom — a payment made under threat — and holds on to something the organisation values, such as its data, its systems or its reputation. They may refuse to hand back stolen records, keep control of servers and workstations, or leave a service unusable until the money arrives. For example, an attacker who finds a way into the booking system of a chain of driving schools might threaten to publish how they did it, so that anyone could copy the trick, unless the schools pay. The schools may pay to protect their reputation, keep customers' details safe and avoid the fines that follow a loss of personal data.

Selling stolen data

Stolen data can also be sold, often to organised criminals. That gives the attacker a financial return without the original organisation paying anything. Organised criminals may pay hackers for stolen data because they can use it for fraud and other crimes, so there is a market for the records an attacker can take.

The financial motive shapes the attack. An attacker who wants a payment or a sale may steal records, hold systems to ransom or threaten to release private information. Not every attack is about money — some are for fun, a challenge or a grudge — but a financially motivated attacker is focused on getting paid.